feat: album covers with palettes and signed links (M2)

- covers are taken from the embedded picture of the first track or a
  cover/folder/front image in the album folder, converted by ffmpeg to
  WebP 64/300/1200 and named by content hash, so albums sharing a cover
  share the files; a full scan looks again for albums without one
- a 3-colour palette (dominant, second, most saturated accent) from a
  deterministic k-means feeds placeholders, page tints and the wave
- /covers/{id} is public but HMAC-signed and immutable; nginx serves
  the file via X-Accel-Redirect, X_ACCEL=false serves it from api
- the web client picks the size by display size and pixel density
- install.sh and update.sh generate STREAM_SIGNING_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/openapi.yaml

@@ -732,6 +732,43 @@ paths:
           description: Переиндексация запущена
         default:
           $ref: "#/components/responses/Problem"
+  /api/v1/covers/{id}:
+    get:
+      operationId: getCover
+      tags: [catalog]
+      security: []
+      summary: Обложка альбома (WebP)
+      description: |
+        Ссылку целиком даёт `cover_url` альбома (подписана, без срока: обложка с данным `v` неизменна);
+        клиент добавляет `size`. Файл отдаёт nginx через X-Accel-Redirect.
+      parameters:
+        - $ref: "#/components/parameters/EntityId"
+        - name: v
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: sig
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: size
+          in: query
+          schema:
+            type: integer
+            enum: [64, 300, 1200]
+            default: 300
+      responses:
+        "200":
+          description: Картинка
+          content:
+            image/webp:
+              schema:
+                type: string
+                format: binary
+        default:
+          $ref: "#/components/responses/Problem"
 components:
   parameters:
     SourceId: